General
- Target QUOTATION.exe
- Size 298KB
- Sample201109-5w5sd367xe
- SHA256 ba9fbfd1eecd1879588201af8b4498bcef57e8950286170dbb0c7c5b7ded6a17
- MD5 81776e210ce744574f3d7995018dce4f
- SHA1 36cd6ce22e5d7fc8ddd142584637238100ab96b1
- SHA512 521a5fe6dd1cefb861cc20e9cbcf169acc0f0a5b86f88aaf2b07243c38fd4f5bb79b4750539a3ecf3c3668d155aaf499e5dee1c283e7cc1cb9f3fa98b2594679
- MD5 SHA1 SHA512
Static task
static1
Behavioral task
behavioral1
Sample
QUOTATION.exe
Resource
win7v20201028
Malware Config
Extracted
-
formbook
-
http://www.nyoxibwer.com/20w/
-
cofounder.technology
-
mrbajaf.com
-
xn--w9s874cfjq5fk.com
-
haliciogluhali.net
-
vanessadunfordhere.com
-
lookguy.win
-
91javac.com
-
goldennd.com
-
nwatheeliteteam.net
-
tumpukganda.com
-
clarservicios.com
-
koghana.com
-
workingwithroland.com
-
yellowsocialbox.com
-
under-dawg.com
-
sdtjtzyz.com
-
banditaerialproductions.com
-
newssmog.com
-
tefnmp.men
-
rebelialabel.com
-
shubhankarthinks.com
-
weldlngwarehouseinc.com
-
cxwlkjgs.com
-
sfbtadvertising.com
-
just-climb-it.com
-
abigailstales.net
-
erreapeworld.com
-
ujoi0cb3td.com
-
adhitshet.com
-
loi-mezard-invest.com
-
shimanami-guesthouse.com
-
5bu3.com
-
koszr.info
-
shopgoperinnovation.com
-
matthiasdittert.com
-
stiffeducation.com
-
projectoverflowinc.com
-
v5rayp.club
-
dqklfr.info
-
jacobsonfordl.com
-
chicagobps.biz
-
bsateenalsharq.com
-
238bifa.com
-
kairui.ink
-
lai2151.com
-
simplysavvysolutions.com
-
watertable.win
-
robotica.tech
-
avggrfx.com
-
teleportcafe.com
-
712roofing.com
-
07hosting.com
-
quiltlux.com
-
implantcyrkonowy.com
-
gnbaccelerator.com
-
negusangel.com
-
best1caratdiamondrings.com
-
elizabethlampertpr.net
-
pinpointlocalsacramento.com
-
skinstradesarea.com
-
morganhelps.com
-
divarium.com
-
njswd.com
-
bfmjgame.com
Targets
-
- Target QUOTATION.exe
- Size 298KB
- SHA256 ba9fbfd1eecd1879588201af8b4498bcef57e8950286170dbb0c7c5b7ded6a17
- MD5 81776e210ce744574f3d7995018dce4f
- SHA1 36cd6ce22e5d7fc8ddd142584637238100ab96b1
- SHA512 521a5fe6dd1cefb861cc20e9cbcf169acc0f0a5b86f88aaf2b07243c38fd4f5bb79b4750539a3ecf3c3668d155aaf499e5dee1c283e7cc1cb9f3fa98b2594679
- MD5 SHA1 SHA512
-
Formbook Payload
-
Deletes itself
-
Suspicious use of SetThreadContext